---
title: Hunt: the JITTERLY/SIXZUT actor behind the Zyxel GS1900 exploit uses *.981666[.]xyz for C2 on odd ports and hides processes named 'configd' | ctxsec
url: https://ctxsec.com/items/hunt-jitterly-sixzut-981666-xyz-zyxel-gs1900-exploit-bundle
description: "Binarly traced the Zyxel GS1900 exploit to the operator of JITTERLY, a Linux backdoor that Acronis TRU previously saw dropped through Gitea exploitation along with the SIXZUT user-mode rootkit. Every sample Binarly found used hostnames under 981666[.]xyz, varying only the hostname, port and AES keys. The exploit bundle sat in an open directory on one of those hosts."
status: "official (Binarly research and IoCs, Nov 3)"
published: 2026-11-03
---

> Binarly traced the Zyxel GS1900 exploit to the operator of JITTERLY, a Linux backdoor that Acronis TRU previously saw dropped through Gitea exploitation along with the SIXZUT user-mode rootkit. Every sample Binarly found used hostnames under 981666[.]xyz, varying only the hostname, port and AES keys. The exploit bundle sat in an open directory on one of those hosts.

[← Threat Hunting](/hunting) · [markdown](/items/hunt-jitterly-sixzut-981666-xyz-zyxel-gs1900-exploit-bundle.md)

official (Binarly research and IoCs, Nov 3)

2026-11-03

### Hunt: the JITTERLY/SIXZUT actor behind the Zyxel GS1900 exploit uses *.981666[.]xyz for C2 on odd ports and hides processes named 'configd'

- **C2 hostnames and ports:** p1.981666[.]xyz:6443, p2.981666[.]xyz:8080, s2.981666[.]xyz:8082, s7.981666[.]xyz:443. Block and search DNS logs for the whole `981666[.]xyz` domain.
- **IPs (Binarly):** 104.223.65[.]148 (JITTERLY C2 on 8080; open directories on 80 and 18081, where `gs1900_bundle.tar.gz` was hosted), 104.225.153[.]141 (C2 on 5432, 6379 and 8082), 166.88.227[.]181 (C2 on 443), 203.88.123[.]148 (SoybeanAdmin admin panel and SSH).
- **Hashes (SHA-256):** JITTERLY 82d072ab03d90c0131b06a576eadf2c986a51f0de986d50db4e49be01bf125cb, 663a8088faca8e126a11648f5671fcf4eaf96435e10daf63a1d1b17d8385154c, 0f6e757e82c4d91df5bd249f775b9970b59dee42cc0dfe40f879d77fc16821c6; embedded SIXZUT 295133156b6a7d95b9c92f832f49e35235f1fbd3906e75c9202ef4cd65d1018c, 64677002011bc2e4bc642a4154a20fdb95620ebd0144b98fc60f917901ec8b92, 728810b07e911b235f6450e784391e39f68819a0a5d209662162916ffea25146.
- **Host behavior:** the SIXZUT sample hides processes named `configd` and its connections to s2.981666[.]xyz:8082, so check with tools that don't rely on the host's own process listing (e.g. compare `/proc` against `ps`, or look at connections from the network side).
- **Switch side:** the exploit's built-in examples write to `/tmp` and start `busybox telnetd -p 2323 -l /bin/sh`; look for TCP 2323 or other new listeners on GS1900 management IPs and for HTTP requests to their CGI endpoints from non-admin hosts.

Also review Gitea servers reachable from the internet, since that was the original JITTERLY entry point Acronis reported.

Sources: [Binarly: Zyxel GS1900 pre-auth RCE exploited in the wild as a zero-day (IoCs)](https://www.binarly.io/blog/zyxel-gs1900-rce-cve-2026-107441) · [Binarly advisory BRLY-2026-057](https://www.binarly.io/advisories/brly-2026-057)